hereya-cli 0.95.5 → 0.97.0

package/README.md

@@ -21,7 +21,7 @@ $ npm install -g hereya-cli
 $ hereya COMMAND
 running command...
 $ hereya (--version)
-hereya-cli/0.95.5 linux-x64 node-v24.14.1
+hereya-cli/0.97.0 linux-x64 node-v24.14.1
 $ hereya --help [COMMAND]
 USAGE
   $ hereya COMMAND
@@ -129,7 +129,7 @@ EXAMPLES
   $ hereya add cloudy/docker_postgres
 ```
 
-_See code: [src/commands/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/add/index.ts)_
+_See code: [src/commands/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/add/index.ts)_
 
 ## `hereya app deploy NAME`
 
@@ -163,7 +163,7 @@ EXAMPLES
   $ hereya app deploy my-org/my-app -w prod -p organizationId=org-123
 ```
 
-_See code: [src/commands/app/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/app/deploy/index.ts)_
+_See code: [src/commands/app/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/app/deploy/index.ts)_
 
 ## `hereya app deployments NAME`
 
@@ -183,7 +183,7 @@ EXAMPLES
   $ hereya app deployments my-org/my-app
 ```
 
-_See code: [src/commands/app/deployments/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/app/deployments/index.ts)_
+_See code: [src/commands/app/deployments/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/app/deployments/index.ts)_
 
 ## `hereya app destroy NAME`
 
@@ -212,7 +212,7 @@ EXAMPLES
   $ hereya app destroy my-org/my-app -w my-workspace
 ```
 
-_See code: [src/commands/app/destroy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/app/destroy/index.ts)_
+_See code: [src/commands/app/destroy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/app/destroy/index.ts)_
 
 ## `hereya app env NAME [KEY]`
 
@@ -238,7 +238,7 @@ EXAMPLES
   $ hereya app env my-org/my-app -w my-workspace DATABASE_URL
 ```
 
-_See code: [src/commands/app/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/app/env/index.ts)_
+_See code: [src/commands/app/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/app/env/index.ts)_
 
 ## `hereya app list`
 
@@ -255,7 +255,7 @@ EXAMPLES
   $ hereya app list
 ```
 
-_See code: [src/commands/app/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/app/list/index.ts)_
+_See code: [src/commands/app/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/app/list/index.ts)_
 
 ## `hereya app new DIRNAME`
 
@@ -281,7 +281,7 @@ EXAMPLES
   $ hereya app new ./my-app -n my-org/my-app --description "An ai-app-builder app"
 ```
 
-_See code: [src/commands/app/new/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/app/new/index.ts)_
+_See code: [src/commands/app/new/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/app/new/index.ts)_
 
 ## `hereya app status NAME`
 
@@ -304,7 +304,7 @@ EXAMPLES
   $ hereya app status my-org/my-app -w my-workspace
 ```
 
-_See code: [src/commands/app/status/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/app/status/index.ts)_
+_See code: [src/commands/app/status/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/app/status/index.ts)_
 
 ## `hereya bootstrap INFRASTRUCTURETYPE`
 
@@ -329,7 +329,7 @@ EXAMPLES
   $ hereya bootstrap local
 ```
 
-_See code: [src/commands/bootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/bootstrap/index.ts)_
+_See code: [src/commands/bootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/bootstrap/index.ts)_
 
 ## `hereya clone PROJECT`
 
@@ -354,7 +354,7 @@ EXAMPLES
   $ hereya clone myProject --chdir=./myProject
 ```
 
-_See code: [src/commands/clone/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/clone/index.ts)_
+_See code: [src/commands/clone/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/clone/index.ts)_
 
 ## `hereya config export-backend [FILE]`
 
@@ -376,7 +376,7 @@ EXAMPLES
   $ hereya config export-backend ./path/to/export.json
 ```
 
-_See code: [src/commands/config/export-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/config/export-backend/index.ts)_
+_See code: [src/commands/config/export-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/config/export-backend/index.ts)_
 
 ## `hereya config get-backend`
 
@@ -393,7 +393,7 @@ EXAMPLES
   $ hereya config get-backend
 ```
 
-_See code: [src/commands/config/get-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/config/get-backend/index.ts)_
+_See code: [src/commands/config/get-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/config/get-backend/index.ts)_
 
 ## `hereya config import-backend FILE`
 
@@ -413,7 +413,7 @@ EXAMPLES
   $ hereya config import-backend ./path/to/cloud-backend.json
 ```
 
-_See code: [src/commands/config/import-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/config/import-backend/index.ts)_
+_See code: [src/commands/config/import-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/config/import-backend/index.ts)_
 
 ## `hereya config use-backend TYPE`
 
@@ -435,7 +435,7 @@ EXAMPLES
   $ hereya config use-backend local
 ```
 
-_See code: [src/commands/config/use-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/config/use-backend/index.ts)_
+_See code: [src/commands/config/use-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/config/use-backend/index.ts)_
 
 ## `hereya delete-state`
 
@@ -461,7 +461,7 @@ EXAMPLES
   $ hereya delete-state --workspace staging
 ```
 
-_See code: [src/commands/delete-state/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/delete-state/index.ts)_
+_See code: [src/commands/delete-state/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/delete-state/index.ts)_
 
 ## `hereya deploy`
 
@@ -487,11 +487,11 @@ EXAMPLES
   $ hereya deploy
 ```
 
-_See code: [src/commands/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/deploy/index.ts)_
+_See code: [src/commands/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/deploy/index.ts)_
 
 ## `hereya devenv config`
 
-Configure SSH for a dev environment and display connection details.
+Configure SSH for a dev environment and display connection details. On-demand devenvs use a ProxyCommand that wakes the instance on first connection.
 
 ```
 USAGE
@@ -501,13 +501,14 @@ FLAGS
   -w, --workspace=<value>  (required) name of the workspace to configure SSH for
 
 DESCRIPTION
-  Configure SSH for a dev environment and display connection details.
+  Configure SSH for a dev environment and display connection details. On-demand devenvs use a ProxyCommand that wakes
+  the instance on first connection.
 
 EXAMPLES
   $ hereya devenv config -w my-workspace
 ```
 
-_See code: [src/commands/devenv/config/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/devenv/config/index.ts)_
+_See code: [src/commands/devenv/config/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/devenv/config/index.ts)_
 
 ## `hereya devenv install`
 
@@ -534,7 +535,7 @@ EXAMPLES
   $ hereya devenv install -w my-workspace -p instanceType=t3.large
 ```
 
-_See code: [src/commands/devenv/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/devenv/install/index.ts)_
+_See code: [src/commands/devenv/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/devenv/install/index.ts)_
 
 ## `hereya devenv project init PROJECT`
 
@@ -566,7 +567,7 @@ EXAMPLES
   $ hereya devenv project init my-app -w my-workspace -t acme/node-starter -p region=us-east-1
 ```
 
-_See code: [src/commands/devenv/project/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/devenv/project/init/index.ts)_
+_See code: [src/commands/devenv/project/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/devenv/project/init/index.ts)_
 
 ## `hereya devenv project uninit PROJECT`
 
@@ -592,7 +593,7 @@ EXAMPLES
   $ hereya devenv project uninit my-app -w my-workspace --force
 ```
 
-_See code: [src/commands/devenv/project/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/devenv/project/uninit/index.ts)_
+_See code: [src/commands/devenv/project/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/devenv/project/uninit/index.ts)_
 
 ## `hereya devenv sleep`
 
@@ -613,7 +614,7 @@ EXAMPLES
   $ hereya devenv sleep -w my-workspace
 ```
 
-_See code: [src/commands/devenv/sleep/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/devenv/sleep/index.ts)_
+_See code: [src/commands/devenv/sleep/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/devenv/sleep/index.ts)_
 
 ## `hereya devenv ssh`
 
@@ -633,7 +634,7 @@ EXAMPLES
   $ hereya devenv ssh -w my-workspace
 ```
 
-_See code: [src/commands/devenv/ssh/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/devenv/ssh/index.ts)_
+_See code: [src/commands/devenv/ssh/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/devenv/ssh/index.ts)_
 
 ## `hereya devenv uninstall`
 
@@ -654,7 +655,7 @@ EXAMPLES
   $ hereya devenv uninstall -w my-workspace
 ```
 
-_See code: [src/commands/devenv/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/devenv/uninstall/index.ts)_
+_See code: [src/commands/devenv/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/devenv/uninstall/index.ts)_
 
 ## `hereya doc PACKAGE`
 
@@ -687,7 +688,7 @@ EXAMPLES
   $ hereya doc my-package --no-doc
 ```
 
-_See code: [src/commands/doc/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/doc/index.ts)_
+_See code: [src/commands/doc/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/doc/index.ts)_
 
 ## `hereya docker run IMAGE`
 
@@ -718,7 +719,7 @@ EXAMPLES
   $ hereya docker run myapp:latest -- --rm -v ./data:/data
 ```
 
-_See code: [src/commands/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/docker/run/index.ts)_
+_See code: [src/commands/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/docker/run/index.ts)_
 
 ## `hereya down`
 
@@ -745,7 +746,7 @@ EXAMPLES
   $ hereya down
 ```
 
-_See code: [src/commands/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/down/index.ts)_
+_See code: [src/commands/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/down/index.ts)_
 
 ## `hereya env [NAME]`
 
@@ -776,7 +777,7 @@ EXAMPLES
   $ hereya env -w dev -l
 ```
 
-_See code: [src/commands/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/env/index.ts)_
+_See code: [src/commands/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/env/index.ts)_
 
 ## `hereya env set [NAME]`
 
@@ -803,7 +804,7 @@ EXAMPLES
   $ hereya env set FOO -v bar -w dev
 ```
 
-_See code: [src/commands/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/env/set/index.ts)_
+_See code: [src/commands/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/env/set/index.ts)_
 
 ## `hereya executor start`
 
@@ -837,7 +838,7 @@ EXAMPLES
   HEREYA_TOKEN=<token> HEREYA_CLOUD_URL=https://my-cloud.example.com hereya executor start -w my-workspace
 ```
 
-_See code: [src/commands/executor/start/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/executor/start/index.ts)_
+_See code: [src/commands/executor/start/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/executor/start/index.ts)_
 
 ## `hereya flow add PACKAGE`
 
@@ -875,7 +876,7 @@ EXAMPLES
   $ hereya flow add cloudy/docker_postgres -p DB_NAME=mydb -p DB_USER=admin
 ```
 
-_See code: [src/commands/flow/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/add/index.ts)_
+_See code: [src/commands/flow/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/add/index.ts)_
 
 ## `hereya flow docker run IMAGE`
 
@@ -905,7 +906,7 @@ EXAMPLES
   $ hereya flow docker run --pin myapp:latest -- --rm
 ```
 
-_See code: [src/commands/flow/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/docker/run/index.ts)_
+_See code: [src/commands/flow/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/docker/run/index.ts)_
 
 ## `hereya flow down`
 
@@ -939,7 +940,7 @@ EXAMPLES
   $ hereya flow down --pin
 ```
 
-_See code: [src/commands/flow/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/down/index.ts)_
+_See code: [src/commands/flow/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/down/index.ts)_
 
 ## `hereya flow env [NAME]`
 
@@ -973,7 +974,7 @@ EXAMPLES
   $ hereya flow env -l
 ```
 
-_See code: [src/commands/flow/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/env/index.ts)_
+_See code: [src/commands/flow/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/env/index.ts)_
 
 ## `hereya flow provid PACKAGE`
 
@@ -1002,7 +1003,7 @@ EXAMPLES
   $ hereya flow provid hereya/postgres --pin
 ```
 
-_See code: [src/commands/flow/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/provid/index.ts)_
+_See code: [src/commands/flow/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/provid/index.ts)_
 
 ## `hereya flow remove PACKAGE`
 
@@ -1032,7 +1033,7 @@ EXAMPLES
   $ hereya flow remove cloudy/docker_postgres --profile staging
 ```
 
-_See code: [src/commands/flow/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/remove/index.ts)_
+_See code: [src/commands/flow/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/remove/index.ts)_
 
 ## `hereya flow run CMD`
 
@@ -1061,7 +1062,7 @@ EXAMPLES
   $ hereya flow run --pin -- npm test
 ```
 
-_See code: [src/commands/flow/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/run/index.ts)_
+_See code: [src/commands/flow/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/run/index.ts)_
 
 ## `hereya flow up`
 
@@ -1095,7 +1096,7 @@ EXAMPLES
   $ hereya flow up --pin
 ```
 
-_See code: [src/commands/flow/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/flow/up/index.ts)_
+_See code: [src/commands/flow/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/flow/up/index.ts)_
 
 ## `hereya help [COMMAND]`
 
@@ -1152,7 +1153,7 @@ EXAMPLES
   $ hereya import org/my-package -f state.tfstate -w my-workspace
 ```
 
-_See code: [src/commands/import/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/import/index.ts)_
+_See code: [src/commands/import/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/import/index.ts)_
 
 ## `hereya import-repo PROJECT`
 
@@ -1182,7 +1183,7 @@ EXAMPLES
   $ hereya import-repo myProject -w=dev -r=https://github.com/acme/api --clone --chdir=./api
 ```
 
-_See code: [src/commands/import-repo/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/import-repo/index.ts)_
+_See code: [src/commands/import-repo/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/import-repo/index.ts)_
 
 ## `hereya init PROJECT`
 
@@ -1216,7 +1217,7 @@ EXAMPLES
   $ hereya init myProject -w=dev -t=acme/node-starter -d=prod -p region=us-east-1
 ```
 
-_See code: [src/commands/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/init/index.ts)_
+_See code: [src/commands/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/init/index.ts)_
 
 ## `hereya list`
 
@@ -1233,7 +1234,7 @@ EXAMPLES
   $ hereya list
 ```
 
-_See code: [src/commands/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/list/index.ts)_
+_See code: [src/commands/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/list/index.ts)_
 
 ## `hereya login [URL]`
 
@@ -1262,7 +1263,7 @@ EXAMPLES
   $ hereya login --token=your-token https://cloud.hereya.dev
 ```
 
-_See code: [src/commands/login/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/login/index.ts)_
+_See code: [src/commands/login/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/login/index.ts)_
 
 ## `hereya logout`
 
@@ -1279,7 +1280,7 @@ EXAMPLES
   $ hereya logout
 ```
 
-_See code: [src/commands/logout/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/logout/index.ts)_
+_See code: [src/commands/logout/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/logout/index.ts)_
 
 ## `hereya provid PACKAGE`
 
@@ -1307,7 +1308,7 @@ EXAMPLES
   $ hereya provid hereya/postgres --workspace staging
 ```
 
-_See code: [src/commands/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/provid/index.ts)_
+_See code: [src/commands/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/provid/index.ts)_
 
 ## `hereya publish`
 
@@ -1330,7 +1331,7 @@ EXAMPLES
   $ hereya publish --chdir=/path/to/package
 ```
 
-_See code: [src/commands/publish/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/publish/index.ts)_
+_See code: [src/commands/publish/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/publish/index.ts)_
 
 ## `hereya remove PACKAGE`
 
@@ -1358,7 +1359,7 @@ EXAMPLES
   $ hereya remove cloudy/docker_postgres
 ```
 
-_See code: [src/commands/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/remove/index.ts)_
+_See code: [src/commands/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/remove/index.ts)_
 
 ## `hereya run CMD`
 
@@ -1384,7 +1385,7 @@ EXAMPLES
   $ hereya run -w uat -- node index.js
 ```
 
-_See code: [src/commands/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/run/index.ts)_
+_See code: [src/commands/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/run/index.ts)_
 
 ## `hereya search QUERY`
 
@@ -1415,7 +1416,7 @@ EXAMPLES
   $ hereya search database --json
 ```
 
-_See code: [src/commands/search/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/search/index.ts)_
+_See code: [src/commands/search/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/search/index.ts)_
 
 ## `hereya unbootstrap INFRASTRUCTURETYPE`
 
@@ -1440,7 +1441,7 @@ EXAMPLES
   $ hereya unbootstrap local
 ```
 
-_See code: [src/commands/unbootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/unbootstrap/index.ts)_
+_See code: [src/commands/unbootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/unbootstrap/index.ts)_
 
 ## `hereya undeploy`
 
@@ -1466,7 +1467,7 @@ EXAMPLES
   $ hereya undeploy
 ```
 
-_See code: [src/commands/undeploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/undeploy/index.ts)_
+_See code: [src/commands/undeploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/undeploy/index.ts)_
 
 ## `hereya uninit PROJECT`
 
@@ -1494,7 +1495,7 @@ EXAMPLES
   $ hereya uninit myProject -w dev -p prodWorkspace=prod
 ```
 
-_See code: [src/commands/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/uninit/index.ts)_
+_See code: [src/commands/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/uninit/index.ts)_
 
 ## `hereya up`
 
@@ -1521,7 +1522,7 @@ EXAMPLES
   $ hereya up
 ```
 
-_See code: [src/commands/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/up/index.ts)_
+_See code: [src/commands/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/up/index.ts)_
 
 ## `hereya update [VERSION]`
 
@@ -1543,7 +1544,7 @@ EXAMPLES
   $ hereya update 0.75.0
 ```
 
-_See code: [src/commands/update/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/update/index.ts)_
+_See code: [src/commands/update/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/update/index.ts)_
 
 ## `hereya workspace create NAME`
 
@@ -1568,7 +1569,7 @@ EXAMPLES
   $ hereya workspace create dev
 ```
 
-_See code: [src/commands/workspace/create/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/create/index.ts)_
+_See code: [src/commands/workspace/create/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/create/index.ts)_
 
 ## `hereya workspace delete NAME`
 
@@ -1588,7 +1589,7 @@ EXAMPLES
   $ hereya workspace delete dev
 ```
 
-_See code: [src/commands/workspace/delete/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/delete/index.ts)_
+_See code: [src/commands/workspace/delete/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/delete/index.ts)_
 
 ## `hereya workspace env [NAME]`
 
@@ -1614,7 +1615,7 @@ EXAMPLES
   $ hereya workspace env myEnv -w dev
 ```
 
-_See code: [src/commands/workspace/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/env/index.ts)_
+_See code: [src/commands/workspace/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/env/index.ts)_
 
 ## `hereya workspace env set`
 
@@ -1638,7 +1639,7 @@ EXAMPLES
   $ hereya workspace env set -w my-workspace -n myVar -v my-value -i aws -s
 ```
 
-_See code: [src/commands/workspace/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/env/set/index.ts)_
+_See code: [src/commands/workspace/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/env/set/index.ts)_
 
 ## `hereya workspace env unset`
 
@@ -1659,7 +1660,7 @@ EXAMPLES
   $ hereya workspace env unset -w my-workspace -n myVar
 ```
 
-_See code: [src/commands/workspace/env/unset/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/env/unset/index.ts)_
+_See code: [src/commands/workspace/env/unset/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/env/unset/index.ts)_
 
 ## `hereya workspace executor install`
 
@@ -1674,19 +1675,19 @@ FLAGS
   -p, --parameter=<value>...  parameter for the package, in the form of 'key=value'. Can be specified multiple times.
   -w, --workspace=<value>     (required) name of the workspace
       --debug                 enable debug mode
-      --mode=<option>         [default: always-on] executor mode: always-on (legacy long-lived EC2) or ephemeral (ASG
-                              min=0/max=1 with broker Lambda)
+      --mode=<option>         [default: ephemeral] executor mode: ephemeral (ASG min=0/max=1 with broker Lambda) or
+                              always-on (legacy long-lived EC2)
                               <options: ephemeral|always-on>
 
 DESCRIPTION
   Install a remote executor into a workspace.
 
   Provisions hereya/remote-executor-aws. Two modes are supported:
-  - always-on (default): a long-lived EC2 polls hereya-cloud 24/7.
-  - ephemeral: ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.
+  - ephemeral (default): ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.
+  - always-on: a long-lived EC2 polls hereya-cloud 24/7 (legacy).
 ```
 
-_See code: [src/commands/workspace/executor/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/executor/install/index.ts)_
+_See code: [src/commands/workspace/executor/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/executor/install/index.ts)_
 
 ## `hereya workspace executor token`
 
@@ -1703,7 +1704,7 @@ DESCRIPTION
   Generate a workspace-scoped executor token for the remote executor
 ```
 
-_See code: [src/commands/workspace/executor/token/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/executor/token/index.ts)_
+_See code: [src/commands/workspace/executor/token/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/executor/token/index.ts)_
 
 ## `hereya workspace executor uninstall`
 
@@ -1727,7 +1728,7 @@ DESCRIPTION
   controls log output.
 ```
 
-_See code: [src/commands/workspace/executor/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/executor/uninstall/index.ts)_
+_See code: [src/commands/workspace/executor/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/executor/uninstall/index.ts)_
 
 ## `hereya workspace install PACKAGE`
 
@@ -1754,7 +1755,7 @@ EXAMPLES
   $ hereya workspace install hereya/aws-cognito
 ```
 
-_See code: [src/commands/workspace/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/install/index.ts)_
+_See code: [src/commands/workspace/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/install/index.ts)_
 
 ## `hereya workspace list`
 
@@ -1778,7 +1779,7 @@ EXAMPLES
   $ hereya workspace list --org personal
 ```
 
-_See code: [src/commands/workspace/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/list/index.ts)_
+_See code: [src/commands/workspace/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/list/index.ts)_
 
 ## `hereya workspace set-profile PROFILE`
 
@@ -1802,7 +1803,7 @@ EXAMPLES
   $ hereya workspace set-profile prod-profile -w production
 ```
 
-_See code: [src/commands/workspace/set-profile/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/set-profile/index.ts)_
+_See code: [src/commands/workspace/set-profile/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/set-profile/index.ts)_
 
 ## `hereya workspace uninstall PACKAGE`
 
@@ -1829,5 +1830,5 @@ EXAMPLES
   $ hereya workspace uninstall hereya/aws-cognito
 ```
 
-_See code: [src/commands/workspace/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.5/src/commands/workspace/uninstall/index.ts)_
+_See code: [src/commands/workspace/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.97.0/src/commands/workspace/uninstall/index.ts)_
 <!-- commandsstop -->

package/dist/backend/cloud/cloud-backend/executor-jobs.d.ts

@@ -42,6 +42,14 @@ export declare function pollExecutorJobs(config: CloudHttpConfig, input: {
     success: false;
     unauthorized?: true;
 }>;
+export declare function revokeDevenvToken(config: CloudHttpConfig, input: {
+    workspace: string;
+}): Promise<{
+    reason: string;
+    success: false;
+} | {
+    success: true;
+}>;
 export declare function revokeExecutorToken(config: CloudHttpConfig, input: {
     workspace: string;
 }): Promise<{

package/dist/backend/cloud/cloud-backend/executor-jobs.js

@@ -53,6 +53,17 @@ export async function pollExecutorJobs(config, input) {
     const result = await response.json();
     return { job: result.job, success: true };
 }
+export async function revokeDevenvToken(config, input) {
+    const response = await fetch(`${config.url}/api/workspaces/${encodeURIComponent(input.workspace)}/devenv-token`, {
+        headers: { 'Authorization': `Bearer ${config.accessToken}` },
+        method: 'DELETE',
+    });
+    if (!response.ok) {
+        const error = await safeResponseJson(response);
+        return { reason: error.error || 'Failed to revoke devenv token', success: false };
+    }
+    return { success: true };
+}
 export async function revokeExecutorToken(config, input) {
     const response = await fetch(`${config.url}/api/workspaces/${encodeURIComponent(input.workspace)}/executor-token`, {
         headers: { 'Authorization': `Bearer ${config.accessToken}` },

package/dist/backend/cloud/cloud-backend.d.ts

@@ -146,6 +146,14 @@ export declare class CloudBackend implements Backend {
     publishPackage(input: Parameters<typeof packagesPublish.publishPackage>[1]): Promise<import("../common.js").PublishPackageOutput>;
     registerExecutorBroker(input: executorBroker.RegisterExecutorBrokerInput): Promise<executorBroker.RegisterExecutorBrokerOutput>;
     removePackageFromWorkspace(input: Parameters<typeof packagesWorkspace.removePackageFromWorkspace>[1]): Promise<import("../common.js").AddPackageToWorkspaceOutput>;
+    revokeDevenvToken(input: {
+        workspace: string;
+    }): Promise<{
+        reason: string;
+        success: false;
+    } | {
+        success: true;
+    }>;
     revokeExecutorToken(input: {
         workspace: string;
     }): Promise<{

package/dist/backend/cloud/cloud-backend.js

@@ -114,6 +114,9 @@ export class CloudBackend {
     removePackageFromWorkspace(input) {
         return packagesWorkspace.removePackageFromWorkspace(this.config, input);
     }
+    revokeDevenvToken(input) {
+        return executorJobs.revokeDevenvToken(this.config, input);
+    }
     revokeExecutorToken(input) {
         return executorJobs.revokeExecutorToken(this.config, input);
     }

package/dist/commands/devenv/config/index.d.ts

@@ -3,8 +3,20 @@ export declare function buildSshConfigBlock(options: {
     host: string;
     hostAlias: string;
     keyFilePath: string;
+    proxyCommand?: string;
     sshUser: string;
 }): string;
+/**
+ * Resolve the path to the hereya binary so we can bake an absolute
+ * ProxyCommand into the SSH config. SSH invokes ProxyCommand without
+ * inheriting the user's interactive shell PATH (it uses /bin/sh and the
+ * stripped login env), so a bare `hereya` often won't resolve. Prefer
+ * `process.argv[1]` (the actual binary that ran us) — that path is what's
+ * already on the user's machine and just worked. Fall back to `hereya` if
+ * argv[1] is missing for any reason; users can fix their PATH or re-run
+ * `devenv config` from a binary they want the SSH proxy to use.
+ */
+export declare function resolveHereyaBinForProxyCommand(): string;
 export declare function upsertSshConfigBlock(existingConfig: string, newBlock: string, hostAlias: string): string;
 export default class DevenvConfig extends Command {
     static description: string;

package/dist/commands/devenv/config/index.js

@@ -6,20 +6,43 @@ import { getBackend } from '../../../backend/index.js';
 import { getExecutorForWorkspace } from '../../../executor/context.js';
 import { setKeyFilePermissions, setSshDirPermissions } from '../../../lib/ssh-utils.js';
 export function buildSshConfigBlock(options) {
-    const { host, hostAlias, keyFilePath, sshUser } = options;
+    const { host, hostAlias, keyFilePath, proxyCommand, sshUser } = options;
     const knownHostsFile = process.platform === 'win32' ? 'NUL' : '/dev/null';
     const beginMarker = `# hereya-managed:${hostAlias} BEGIN`;
     const endMarker = `# hereya-managed:${hostAlias} END`;
-    return [
+    // On-demand devenvs (proxyCommand provided) need a placeholder HostName —
+    // ssh requires HostName to start a connection but the actual address is
+    // resolved by ProxyCommand at connect time. The alias itself is fine as
+    // a placeholder; ProxyCommand ignores %h.
+    const lines = [
         beginMarker,
         `Host ${hostAlias}`,
         `  HostName ${host}`,
         `  User ${sshUser}`,
         `  IdentityFile ${keyFilePath}`,
-        `  StrictHostKeyChecking no`,
-        `  UserKnownHostsFile ${knownHostsFile}`,
-        endMarker,
-    ].join('\n');
+    ];
+    if (proxyCommand) {
+        lines.push(`  ProxyCommand ${proxyCommand}`);
+    }
+    lines.push(`  StrictHostKeyChecking no`, `  UserKnownHostsFile ${knownHostsFile}`, endMarker);
+    return lines.join('\n');
+}
+/**
+ * Resolve the path to the hereya binary so we can bake an absolute
+ * ProxyCommand into the SSH config. SSH invokes ProxyCommand without
+ * inheriting the user's interactive shell PATH (it uses /bin/sh and the
+ * stripped login env), so a bare `hereya` often won't resolve. Prefer
+ * `process.argv[1]` (the actual binary that ran us) — that path is what's
+ * already on the user's machine and just worked. Fall back to `hereya` if
+ * argv[1] is missing for any reason; users can fix their PATH or re-run
+ * `devenv config` from a binary they want the SSH proxy to use.
+ */
+export function resolveHereyaBinForProxyCommand() {
+    const argv1 = process.argv[1];
+    if (argv1 && argv1.length > 0) {
+        return argv1;
+    }
+    return 'hereya';
 }
 export function upsertSshConfigBlock(existingConfig, newBlock, hostAlias) {
     const beginMarker = `# hereya-managed:${hostAlias} BEGIN`;
@@ -37,7 +60,7 @@ export function upsertSshConfigBlock(existingConfig, newBlock, hostAlias) {
     return existingConfig.trimEnd() + '\n\n' + newBlock + '\n';
 }
 export default class DevenvConfig extends Command {
-    static description = 'Configure SSH for a dev environment and display connection details.';
+    static description = 'Configure SSH for a dev environment and display connection details. On-demand devenvs use a ProxyCommand that wakes the instance on first connection.';
     static examples = [
         '<%= config.bin %> <%= command.id %> -w my-workspace',
     ];
@@ -67,10 +90,15 @@ export default class DevenvConfig extends Command {
         const sshPrivateKey = env.devEnvSshPrivateKey;
         const sshUser = env.devEnvSshUser;
         const sshHostDns = env.devEnvSshHostDns;
-        if (!sshHost || !sshPrivateKey || !sshUser) {
-            this.error('devEnvSshHost, devEnvSshPrivateKey, and devEnvSshUser must be set in the workspace environment');
+        const wakeUrl = env.devEnvWakeUrl;
+        if (!sshPrivateKey || !sshUser) {
+            this.error('devEnvSshPrivateKey and devEnvSshUser must be set in the workspace environment');
+        }
+        // Always-on devenvs need a cached host; on-demand devenvs resolve via
+        // the broker so devEnvSshHost is just a hint (and is often stale).
+        if (!wakeUrl && !sshHost) {
+            this.error('devEnvSshHost must be set in the workspace environment for always-on devenvs');
         }
-        const host = sshHostDns || sshHost;
         const sshDir = path.join(os.homedir(), '.ssh');
         const sanitizedWorkspace = workspace.replaceAll('/', '-');
         const keyFilePath = path.join(sshDir, `hereya-devenv-${sanitizedWorkspace}`);
@@ -87,15 +115,40 @@ export default class DevenvConfig extends Command {
         catch {
             // File doesn't exist yet, that's fine
         }
-        const newBlock = buildSshConfigBlock({ host, hostAlias, keyFilePath, sshUser });
-        const updatedConfig = upsertSshConfigBlock(existingConfig, newBlock, hostAlias);
+        // For on-demand devenvs, emit a ProxyCommand that calls back into this
+        // CLI to wake the box and resolve the live IP every connection. The
+        // cached devEnvSshHost would otherwise drift on every stop/start (EC2
+        // reassigns public IPs). The HostName field still has to be present
+        // for ssh to even try the connection — use the alias as a placeholder
+        // since ProxyCommand ignores %h.
+        const isOnDemand = Boolean(wakeUrl);
+        const block = isOnDemand
+            ? buildSshConfigBlock({
+                host: hostAlias,
+                hostAlias,
+                keyFilePath,
+                proxyCommand: `${resolveHereyaBinForProxyCommand()} devenv ssh-proxy -w ${workspace}`,
+                sshUser,
+            })
+            : buildSshConfigBlock({
+                host: sshHostDns || sshHost,
+                hostAlias,
+                keyFilePath,
+                sshUser,
+            });
+        const updatedConfig = upsertSshConfigBlock(existingConfig, block, hostAlias);
         await fs.writeFile(sshConfigPath, updatedConfig, { mode: 0o600 });
         this.log('SSH connection configured successfully.');
         this.log('');
         this.log('Fill in the Claude Code SSH connection form with:');
         this.log('');
         this.log(`  Name:                ${workspace}`);
-        this.log(`  SSH Host:            ${sshUser}@${host}`);
+        if (isOnDemand) {
+            this.log(`  SSH Host:            ${hostAlias}   (on-demand; wake handled automatically via ProxyCommand)`);
+        }
+        else {
+            this.log(`  SSH Host:            ${sshUser}@${sshHostDns || sshHost}`);
+        }
         this.log(`  SSH Port:            22`);
         this.log(`  Identity File:       ${keyFilePath}`);
         this.log('');

package/dist/commands/devenv/ssh-proxy/index.d.ts

@@ -0,0 +1,27 @@
+import { Command } from '@oclif/core';
+/**
+ * Hidden command used as `ProxyCommand` from the SSH config block written
+ * by `hereya devenv config`. Wakes the devenv (on-demand path) via the
+ * broker, resolves the live IP, then pipes stdin/stdout to <host>:22 so
+ * any SSH client (plain `ssh`, VS Code Remote SSH, Cursor, etc.) connects
+ * through the resolved address transparently.
+ *
+ * Equivalent to `ssh -W %h:%p` semantics, except %h/%p are resolved here
+ * (host comes from the broker, port is fixed at 22). Uses Node's built-in
+ * `net` module so we don't depend on an external `nc`/`ncat` being on PATH.
+ */
+export default class DevenvSshProxy extends Command {
+    static description: string;
+    static flags: {
+        workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    static hidden: boolean;
+    /**
+     * Open a TCP socket to <host>:<port> and pipe between stdin/stdout and
+     * the socket — the canonical SSH ProxyCommand contract. Resolves when
+     * the SSH client closes (EOF on stdin / socket end), with the appropriate
+     * exit code on error.
+     */
+    protected pipeToHost(host: string, port: number): Promise<void>;
+    run(): Promise<void>;
+}

package/dist/commands/devenv/ssh-proxy/index.js

@@ -0,0 +1,80 @@
+import { Command, Flags } from '@oclif/core';
+import * as net from 'node:net';
+import { getBackend } from '../../../backend/index.js';
+import { getExecutorForWorkspace } from '../../../executor/context.js';
+import { resolveDevenvSshHost } from '../../../lib/devenv-wake.js';
+/**
+ * Hidden command used as `ProxyCommand` from the SSH config block written
+ * by `hereya devenv config`. Wakes the devenv (on-demand path) via the
+ * broker, resolves the live IP, then pipes stdin/stdout to <host>:22 so
+ * any SSH client (plain `ssh`, VS Code Remote SSH, Cursor, etc.) connects
+ * through the resolved address transparently.
+ *
+ * Equivalent to `ssh -W %h:%p` semantics, except %h/%p are resolved here
+ * (host comes from the broker, port is fixed at 22). Uses Node's built-in
+ * `net` module so we don't depend on an external `nc`/`ncat` being on PATH.
+ */
+export default class DevenvSshProxy extends Command {
+    static description = 'Internal: SSH ProxyCommand for on-demand devenvs (wake + connect).';
+    static flags = {
+        workspace: Flags.string({
+            char: 'w',
+            description: 'name of the workspace to proxy SSH for',
+            required: true,
+        }),
+    };
+    static hidden = true;
+    /**
+     * Open a TCP socket to <host>:<port> and pipe between stdin/stdout and
+     * the socket — the canonical SSH ProxyCommand contract. Resolves when
+     * the SSH client closes (EOF on stdin / socket end), with the appropriate
+     * exit code on error.
+     */
+    pipeToHost(host, port) {
+        return new Promise((resolve, reject) => {
+            const socket = net.createConnection({ host, port });
+            socket.once('error', (err) => {
+                process.stderr.write(`hereya devenv ssh-proxy: failed to connect to ${host}:${port}: ${err.message}\n`);
+                reject(err);
+            });
+            socket.once('connect', () => {
+                process.stdin.pipe(socket);
+                socket.pipe(process.stdout);
+            });
+            socket.once('end', () => {
+                resolve();
+            });
+            socket.once('close', () => {
+                resolve();
+            });
+        });
+    }
+    async run() {
+        const { flags } = await this.parse(DevenvSshProxy);
+        const { workspace } = flags;
+        const backend = await getBackend();
+        const getWorkspaceEnvOutput = await backend.getWorkspaceEnv({ workspace });
+        if (!getWorkspaceEnvOutput.success) {
+            this.error(getWorkspaceEnvOutput.reason);
+        }
+        let { env } = getWorkspaceEnvOutput;
+        const executor$ = await getExecutorForWorkspace(workspace);
+        if (!executor$.success) {
+            this.error(executor$.reason);
+        }
+        const { executor } = executor$;
+        env = await executor.resolveEnvValues({ env });
+        let host;
+        try {
+            host = await resolveDevenvSshHost(env);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            // Print to stderr so SSH surfaces it, then exit non-zero so SSH
+            // reports a clean failure to the user.
+            process.stderr.write(`hereya devenv ssh-proxy: ${message}\n`);
+            this.exit(1);
+        }
+        await this.pipeToHost(host, 22);
+    }
+}

package/dist/commands/devenv/uninstall/index.js

@@ -1,5 +1,6 @@
 import { Command, Flags } from '@oclif/core';
 import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
+import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getCloudCredentials, loadBackendConfig } from '../../../backend/config.js';
 import { getBackend } from '../../../backend/index.js';
 import { getExecutorForWorkspace } from '../../../executor/context.js';
@@ -192,6 +193,24 @@ export default class DevenvUninstall extends Command {
                             },
                             title: 'Destroying dev environment',
                         },
+                        {
+                            async task() {
+                                const backend = await getBackend();
+                                if (!(backend instanceof CloudBackend)) {
+                                    // Local-only setup — no devenv tokens to revoke. Silently skip.
+                                    return;
+                                }
+                                const result = await backend.revokeDevenvToken({ workspace: flags.workspace });
+                                if (!result.success) {
+                                    // Non-fatal: destroy already succeeded. Surface a warning so the
+                                    // user knows the token will only expire on its own (365-day TTL).
+                                    // Mirrors the executor uninstall's posture — destroy is the
+                                    // unrecoverable step; auth cleanup is best-effort.
+                                    process.stderr.write(`warning: failed to revoke devenv token: ${result.reason}\n`);
+                                }
+                            },
+                            title: 'Revoking devenv token',
+                        },
                         {
                             async task(ctx) {
                                 const { env, metadata } = ctx.destroyOutput;

package/dist/commands/workspace/executor/install/index.js

@@ -10,14 +10,14 @@ export default class WorkspaceExecutorInstall extends Command {
     static description = `Install a remote executor into a workspace.
 
 Provisions hereya/remote-executor-aws. Two modes are supported:
-  - always-on (default): a long-lived EC2 polls hereya-cloud 24/7.
-  - ephemeral: ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.`;
+  - ephemeral (default): ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.
+  - always-on: a long-lived EC2 polls hereya-cloud 24/7 (legacy).`;
     static flags = {
         debug: Flags.boolean({ default: false, description: 'enable debug mode' }),
         force: Flags.boolean({ char: 'f', default: false, description: 'force reinstall even if executor is already installed' }),
         mode: Flags.string({
-            default: 'always-on',
-            description: 'executor mode: always-on (legacy long-lived EC2) or ephemeral (ASG min=0/max=1 with broker Lambda)',
+            default: 'ephemeral',
+            description: 'executor mode: ephemeral (ASG min=0/max=1 with broker Lambda) or always-on (legacy long-lived EC2)',
             options: ['ephemeral', 'always-on'],
         }),
         parameter: Flags.string({

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { type GetInfrastructureFn, type GetWorkspaceEnvFn, type MintInstallationTokenFn, type ResolveEnvProviders, resolveEnvValues, type ResolveEnvValuesInput, type ResolveEnvValuesOutput, resolveGithubAppMarkers, type ResolveSimpleEnvFn, } from './executor/resolve-env.js';
 export { InfrastructureType } from './infrastructure/common.js';
 export { awsProviderFactory, getInfrastructure, type GetInfrastructureInput, type GetInfrastructureOutput, type InfrastructureProviderFactory, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
+export { mintInstallationToken, type MintInstallationTokenInput, } from './lib/github-app.js';
 export { run } from '@oclif/core';

package/dist/index.js

@@ -5,4 +5,5 @@
 export { resolveEnvValues, resolveGithubAppMarkers, } from './executor/resolve-env.js';
 export { InfrastructureType } from './infrastructure/common.js';
 export { awsProviderFactory, getInfrastructure, registerInfrastructureProvider, resetInfrastructureProviders, } from './infrastructure/registry.js';
+export { mintInstallationToken, } from './lib/github-app.js';
 export { run } from '@oclif/core';

package/oclif.manifest.json

@@ -170,13 +170,12 @@
         "index.js"
       ]
     },
-    "delete-state": {
+    "deploy": {
       "aliases": [],
       "args": {},
-      "description": "Delete the remote state of a project for a given workspace",
+      "description": "Deploy a hereya project using the project deployment package",
       "examples": [
-        "<%= config.bin %> <%= command.id %> -w dev",
-        "<%= config.bin %> <%= command.id %> --workspace staging"
+        "<%= config.bin %> <%= command.id %>"
       ],
       "flags": {
         "chdir": {
@@ -187,9 +186,21 @@
           "multiple": false,
           "type": "option"
         },
+        "debug": {
+          "description": "enable debug mode",
+          "name": "debug",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "local": {
+          "description": "force local execution (skip remote executor)",
+          "name": "local",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "workspace": {
           "char": "w",
-          "description": "workspace name",
+          "description": "name of the workspace to deploy the packages for",
           "name": "workspace",
           "required": true,
           "hasDynamicHelp": false,
@@ -199,7 +210,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "delete-state",
+      "id": "deploy",
       "pluginAlias": "hereya-cli",
       "pluginName": "hereya-cli",
       "pluginType": "core",
@@ -209,16 +220,17 @@
       "relativePath": [
         "dist",
         "commands",
-        "delete-state",
+        "deploy",
         "index.js"
       ]
     },
-    "deploy": {
+    "delete-state": {
       "aliases": [],
       "args": {},
-      "description": "Deploy a hereya project using the project deployment package",
+      "description": "Delete the remote state of a project for a given workspace",
       "examples": [
-        "<%= config.bin %> <%= command.id %>"
+        "<%= config.bin %> <%= command.id %> -w dev",
+        "<%= config.bin %> <%= command.id %> --workspace staging"
       ],
       "flags": {
         "chdir": {
@@ -229,21 +241,9 @@
           "multiple": false,
           "type": "option"
         },
-        "debug": {
-          "description": "enable debug mode",
-          "name": "debug",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "local": {
-          "description": "force local execution (skip remote executor)",
-          "name": "local",
-          "allowNo": false,
-          "type": "boolean"
-        },
         "workspace": {
           "char": "w",
-          "description": "name of the workspace to deploy the packages for",
+          "description": "workspace name",
           "name": "workspace",
           "required": true,
           "hasDynamicHelp": false,
@@ -253,7 +253,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "deploy",
+      "id": "delete-state",
       "pluginAlias": "hereya-cli",
       "pluginName": "hereya-cli",
       "pluginType": "core",
@@ -263,7 +263,7 @@
       "relativePath": [
         "dist",
         "commands",
-        "deploy",
+        "delete-state",
         "index.js"
       ]
     },
@@ -1704,7 +1704,7 @@
     "devenv:config": {
       "aliases": [],
       "args": {},
-      "description": "Configure SSH for a dev environment and display connection details.",
+      "description": "Configure SSH for a dev environment and display connection details. On-demand devenvs use a ProxyCommand that wakes the instance on first connection.",
       "examples": [
         "<%= config.bin %> <%= command.id %> -w my-workspace"
       ],
@@ -1886,6 +1886,39 @@
         "index.js"
       ]
     },
+    "devenv:ssh-proxy": {
+      "aliases": [],
+      "args": {},
+      "description": "Internal: SSH ProxyCommand for on-demand devenvs (wake + connect).",
+      "flags": {
+        "workspace": {
+          "char": "w",
+          "description": "name of the workspace to proxy SSH for",
+          "name": "workspace",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hidden": true,
+      "hiddenAliases": [],
+      "id": "devenv:ssh-proxy",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "devenv",
+        "ssh-proxy",
+        "index.js"
+      ]
+    },
     "devenv:uninstall": {
       "aliases": [],
       "args": {},
@@ -3221,7 +3254,7 @@
     "workspace:executor:install": {
       "aliases": [],
       "args": {},
-      "description": "Install a remote executor into a workspace.\n\nProvisions hereya/remote-executor-aws. Two modes are supported:\n  - always-on (default): a long-lived EC2 polls hereya-cloud 24/7.\n  - ephemeral: ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.",
+      "description": "Install a remote executor into a workspace.\n\nProvisions hereya/remote-executor-aws. Two modes are supported:\n  - ephemeral (default): ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.\n  - always-on: a long-lived EC2 polls hereya-cloud 24/7 (legacy).",
       "flags": {
         "debug": {
           "description": "enable debug mode",
@@ -3237,9 +3270,9 @@
           "type": "boolean"
         },
         "mode": {
-          "description": "executor mode: always-on (legacy long-lived EC2) or ephemeral (ASG min=0/max=1 with broker Lambda)",
+          "description": "executor mode: ephemeral (ASG min=0/max=1 with broker Lambda) or always-on (legacy long-lived EC2)",
           "name": "mode",
-          "default": "always-on",
+          "default": "ephemeral",
           "hasDynamicHelp": false,
           "multiple": false,
           "options": [
@@ -3369,5 +3402,5 @@
       ]
     }
   },
-  "version": "0.95.5"
+  "version": "0.97.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hereya-cli",
   "description": "Infrastructure as Package",
-  "version": "0.95.5",
+  "version": "0.97.0",
   "author": "Hereya Developers",
   "bin": {
     "hereya": "./bin/run.js"